queue-4.19/intel_th-don-t-reference-unassigned-outputs.patch

   1 From 9ed3f22223c33347ed963e7c7019cf2956dd4e37 Mon Sep 17 00:00:00 2001
   2 From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
   3 Date: Thu, 24 Jan 2019 15:11:53 +0200
   4 Subject: intel_th: Don't reference unassigned outputs
   5
   6 From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
   7
   8 commit 9ed3f22223c33347ed963e7c7019cf2956dd4e37 upstream.
   9
  10 When an output port driver is removed, also remove references to it from
  11 any masters. Failing to do this causes a NULL ptr dereference when
  12 configuring another output port:
  13
  14 > BUG: unable to handle kernel NULL pointer dereference at 000000000000000d
  15 > RIP: 0010:master_attr_store+0x9d/0x160 [intel_th_gth]
  16 > Call Trace:
  17 > dev_attr_store+0x1b/0x30
  18 > sysfs_kf_write+0x3c/0x50
  19 > kernfs_fop_write+0x125/0x1a0
  20 > __vfs_write+0x3a/0x190
  21 > ? __vfs_write+0x5/0x190
  22 > ? _cond_resched+0x1a/0x50
  23 > ? rcu_all_qs+0x5/0xb0
  24 > ? __vfs_write+0x5/0x190
  25 > vfs_write+0xb8/0x1b0
  26 > ksys_write+0x55/0xc0
  27 > __x64_sys_write+0x1a/0x20
  28 > do_syscall_64+0x5a/0x140
  29 > entry_SYSCALL_64_after_hwframe+0x44/0xa9
  30
  31 Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
  32 Fixes: b27a6a3f97b9 ("intel_th: Add Global Trace Hub driver")
  33 CC: stable@vger.kernel.org # v4.4+
  34 Reported-by: Ammy Yi <ammy.yi@intel.com>
  35 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
  36
  37 ---
  38  drivers/hwtracing/intel_th/gth.c |    4 ++++
  39  1 file changed, 4 insertions(+)
  40
  41 --- a/drivers/hwtracing/intel_th/gth.c
  42 +++ b/drivers/hwtracing/intel_th/gth.c
  43 @@ -607,6 +607,7 @@ static void intel_th_gth_unassign(struct
  44  {
  45         struct gth_device *gth = dev_get_drvdata(&thdev->dev);
  46         int port = othdev->output.port;
  47 +       int master;
  48
  49         if (thdev->host_mode)
  50                 return;
  51 @@ -615,6 +616,9 @@ static void intel_th_gth_unassign(struct
  52         othdev->output.port = -1;
  53         othdev->output.active = false;
  54         gth->output[port].output = NULL;
  55 +       for (master = 0; master < TH_CONFIGURABLE_MASTERS; master++)
  56 +               if (gth->master[master] == port)
  57 +                       gth->master[master] = -1;
  58         spin_unlock(&gth->gth_lock);
  59  }
  60